Command line and environment
Every command-line option and every environment variable Janus Edge 2026.11.1 reads, on one page. Defaults apply when a variable is unset. Each entry links to the page that explains it in full.
The janus binary
Janus is configured entirely through environment variables; run with no arguments, it starts the gateway. It also accepts these one-shot flags, which print a result and exit:
| Flag | What it does |
|---|---|
janus --fips-status | Print, as JSON, which edition this binary is, the Go Cryptographic Module it links and whether FIPS 140-3 mode is on. Exits non-zero when the FIPS edition would refuse to start. |
janus --health-probe | Call this process’s own liveness endpoint and exit 0 when healthy. Container images have no shell or curl, so Docker and Kubernetes health checks run this. |
janus-ctl (Linux installer)
install.py installs Janus as a systemd service and then manages it as janus-ctl. Run it with sudo; with no command it installs. See Install for the walkthrough.
janus-ctl install
install the system service (default command).
| Option | Description |
|---|---|
--version VERSION | release to install (default 2026.11.1) |
--archive ARCHIVE | install from a downloaded archive (offline) |
--checksums CHECKSUMS | the release SHA256SUMS, required with --archive |
--hostname HOSTNAME | name people will use to reach it (default: this machine's FQDN) |
--admin-email ADMIN_EMAIL | create the first administrator with this email |
--admin-name ADMIN_NAME | administrator display name |
--skip-admin | create the administrator in the browser instead; Janus stays loopback-only until then |
--database-url DATABASE_URL | postgres://... to use PostgreSQL (default: SQLite in /var/lib/janus) |
--user | no-sudo trial install into ~/.local (no service) |
janus-ctl upgrade
install another release, keeping configuration and data.
| Option | Description |
|---|---|
--version VERSION | release to install (default 2026.11.1) |
--archive ARCHIVE | install from a downloaded archive (offline) |
--checksums CHECKSUMS | the release SHA256SUMS, required with --archive |
janus-ctl status
show service, readiness and certificate.
janus-ctl open
after a --skip-admin install, listen on all interfaces.
janus-ctl cert
manage the HTTPS certificate.
janus-ctl cert install
use your own certificate and key.
| Option | Description |
|---|---|
--cert CERT required | PEM certificate, ideally the full chain (fullchain.pem) |
--key KEY required | PEM private key, unencrypted (privkey.pem) |
--chain CHAIN | intermediate certificates, if they are not already in --cert |
--hostname HOSTNAME | public name (default: taken from the certificate) |
janus-ctl cert self-signed
replace the certificate with a new self-signed one.
| Option | Description |
|---|---|
--hostname HOSTNAME | name to put on the certificate |
janus-ctl cert acme
get a Let's Encrypt certificate over port 80 and renew it automatically.
| Option | Description |
|---|---|
--domain DOMAIN required | public DNS name that points at this server |
--email EMAIL | contact email for expiry notices |
--staging | use Let's Encrypt staging, for testing |
--server SERVER | another ACME directory URL (default Let's Encrypt) |
janus-ctl cert renew
renew the Let's Encrypt certificate when due (run by a timer).
janus-ctl uninstall
remove the service; keeps configuration and data unless --purge.
| Option | Description |
|---|---|
--purge | also delete configuration, certificates and data |
Environment variables
Only JANUS_ENCRYPTION_KEY is required. Set the rest as needed; the defaults suit a single gateway. The Helm chart and the installer set the deployment-specific ones for you.
Required
| Variable | Default | Description |
|---|---|---|
JANUS_ENCRYPTION_KEY | unset | JANUS_ENCRYPTION_KEY is the only required variable — 32 bytes, given as 64 hex characters (openssl rand -hex 32) or base64, used to encrypt upstream credentials at rest; changing it orphans stored credentials. More |
JANUS_PUBLIC_URL | http://localhost:8080 | JANUS_PUBLIC_URL (default http://localhost:8080) — the externally reachable URL; set it for any deployment reached from another machine. More |
Database
| Variable | Default | Description |
|---|---|---|
JANUS_DATABASE_URL | unset | JANUS_DATABASE_URL — postgres:// (or postgresql://) for production, or sqlite:///absolute/path.db for a single-node deployment. More |
Identity
| Variable | Default | Description |
|---|---|---|
JANUS_ADMIN_GROUPS | unset | JANUS_ADMIN_GROUPS — a comma- or space-separated list of IdP group names, matched case-insensitively against the groups claim on every sign-in — grants the admin capability while membership lasts; leaving the group in the identity provider revokes it at the next sign-in, and removing someone from the group in Janus or through SCIM, or removing the group from an admin-group list, revokes it at once. More |
JANUS_BOOTSTRAP_ADMIN_EMAILS | unset | JANUS_BOOTSTRAP_ADMIN_EMAILS grants the admin role on first sign-in (sticky). More |
JANUS_DEV_AUTH | false | JANUS_DEV_AUTH enables the local evaluation sign-in (no identity provider, any email). More |
JANUS_DEV_AUTH_ALLOW_UNSAFE | false | The gateway refuses to boot with it when JANUS_ENV=production is set explicitly (an unset JANUS_ENV does not count, so the local quick start works) or the public URL is not loopback; JANUS_DEV_AUTH_ALLOW_UNSAFE=true overrides that refusal for isolated demos only. More |
JANUS_OIDC_CLIENT_ID | unset | JANUS_OIDC_PROVIDER_URL, JANUS_OIDC_CLIENT_ID and JANUS_OIDC_CLIENT_SECRET configure the identity provider; if the provider URL is set, the other two must be set too. More |
JANUS_OIDC_CLIENT_SECRET | unset | JANUS_OIDC_PROVIDER_URL, JANUS_OIDC_CLIENT_ID and JANUS_OIDC_CLIENT_SECRET configure the identity provider; if the provider URL is set, the other two must be set too. More |
JANUS_OIDC_EMAIL_CLAIM | email | JANUS_OIDC_EMAIL_CLAIM (default email), JANUS_OIDC_NAME_CLAIM (name) and JANUS_OIDC_GROUPS_CLAIM (groups) override claim names for non-standard providers; JANUS_OIDC_SCOPES (default openid,profile,email,groups) sets the requested scopes. More |
JANUS_OIDC_GROUPS_CLAIM | groups | JANUS_OIDC_EMAIL_CLAIM (default email), JANUS_OIDC_NAME_CLAIM (name) and JANUS_OIDC_GROUPS_CLAIM (groups) override claim names for non-standard providers; JANUS_OIDC_SCOPES (default openid,profile,email,groups) sets the requested scopes. More |
JANUS_OIDC_NAME_CLAIM | name | JANUS_OIDC_EMAIL_CLAIM (default email), JANUS_OIDC_NAME_CLAIM (name) and JANUS_OIDC_GROUPS_CLAIM (groups) override claim names for non-standard providers; JANUS_OIDC_SCOPES (default openid,profile,email,groups) sets the requested scopes. More |
JANUS_OIDC_PROVIDER_URL | unset | JANUS_OIDC_PROVIDER_URL, JANUS_OIDC_CLIENT_ID and JANUS_OIDC_CLIENT_SECRET configure the identity provider; if the provider URL is set, the other two must be set too. More |
JANUS_OIDC_SCOPES | openid,profile,email,groups | JANUS_OIDC_EMAIL_CLAIM (default email), JANUS_OIDC_NAME_CLAIM (name) and JANUS_OIDC_GROUPS_CLAIM (groups) override claim names for non-standard providers; JANUS_OIDC_SCOPES (default openid,profile,email,groups) sets the requested scopes. More |
Serving and sessions
| Variable | Default | Description |
|---|---|---|
JANUS_CA_BUNDLE | unset | Outbound trust store (every outbound TLS connection): JANUS_CA_BUNDLE (a PEM file). More |
JANUS_CA_DIR | unset | Outbound trust store (every outbound TLS connection): JANUS_CA_DIR (a directory of .pem/.crt/.cer files, rescanned every 30 seconds). More |
JANUS_COOKIE_SECURE | unset | JANUS_COOKIE_SECURE to force secure cookies (default: on when the public URL is https). More |
JANUS_LISTEN_ADDR | :8080 | The address and port the gateway listens on. More |
JANUS_SESSION_IDLE_TIMEOUT_HOURS | 4 | JANUS_SESSION_TTL_HOURS (default 24) and JANUS_SESSION_IDLE_TIMEOUT_HOURS (default 4) bound browser sessions. More |
JANUS_SESSION_TTL_HOURS | 24 | JANUS_SESSION_TTL_HOURS (default 24) and JANUS_SESSION_IDLE_TIMEOUT_HOURS (default 4) bound browser sessions. More |
JANUS_TLS_CERT_PATH | unset | JANUS_TLS_CERT_PATH / JANUS_TLS_KEY_PATH for direct TLS with an issued certificate (set both or neither; re-read when they change). More |
JANUS_TLS_KEY_PATH | unset | JANUS_TLS_CERT_PATH / JANUS_TLS_KEY_PATH for direct TLS with an issued certificate (set both or neither; re-read when they change). More |
JANUS_TLS_REQUIRE | false | JANUS_TLS_REQUIRE=true to refuse to start without serving TLS itself. More |
JANUS_TLS_SELF_SIGNED | false | JANUS_TLS_SELF_SIGNED=true for a self-signed listener certificate Janus generates and stores (temporary; names JANUS_TLS_SELF_SIGNED_NAMES, lifetime JANUS_TLS_SELF_SIGNED_DAYS). More |
JANUS_TLS_SELF_SIGNED_DAYS | 365 | JANUS_TLS_SELF_SIGNED=true for a self-signed listener certificate Janus generates and stores (temporary; names JANUS_TLS_SELF_SIGNED_NAMES, lifetime JANUS_TLS_SELF_SIGNED_DAYS). More |
JANUS_TLS_SELF_SIGNED_NAMES | unset | JANUS_TLS_SELF_SIGNED=true for a self-signed listener certificate Janus generates and stores (temporary; names JANUS_TLS_SELF_SIGNED_NAMES, lifetime JANUS_TLS_SELF_SIGNED_DAYS). More |
JANUS_TRUSTED_PROXIES | unset | JANUS_TRUSTED_PROXIES as a comma- or space-separated list of IP addresses or CIDR blocks gating X-Forwarded-For. More |
JANUS_TRUST_DOD_ROOTS | unset | Outbound trust store (every outbound TLS connection): JANUS_TRUST_DOD_ROOTS (the built-in DoD PKI root CAs; default on in the FIPS edition, off otherwise), plus certificates uploaded under Administration → Settings → Certificates. More |
Proxy behavior and retention
| Variable | Default | Description |
|---|---|---|
JANUS_AUDIT_RETENTION_DAYS | 730 | JANUS_USAGE_RETENTION_DAYS (default 365) and JANUS_AUDIT_RETENTION_DAYS (730) control purging, run daily at JANUS_PURGE_JOB_TIME_UTC (default 02:00). More |
JANUS_DB_MAX_CONNS | 25 | JANUS_DB_MAX_CONNS (default 25) caps each replica’s PostgreSQL connection pool. More |
JANUS_DISCOVERY_INTERVAL_MINUTES | 2 | JANUS_DISCOVERY_INTERVAL_MINUTES (default 2) sets the model-discovery cadence — each run also records whether every upstream is reachable, so it doubles as the availability probe — and an administrator can override it at runtime from Administration → Settings → General → Model discovery (PATCH /api/v1/admin/system/discovery-interval), stored in the database, applied immediately without a restart, and audit-logged. More |
JANUS_ENV | production | JANUS_ENV (default production) labels the deployment; JANUS_LOG_LEVEL (default info) is debug, info, warn, or error. More |
JANUS_LOG_LEVEL | info | JANUS_ENV (default production) labels the deployment; JANUS_LOG_LEVEL (default info) is debug, info, warn, or error. More |
JANUS_MAX_RESPONSE_BYTES | 104857600 | JANUS_MAX_RESPONSE_BYTES (default 104857600, 100 MiB) caps buffered responses. More |
JANUS_PERFORMANCE_MODE | false | JANUS_PERFORMANCE_MODE (default false; Business edition) raises the request rate one replica can meter. More |
JANUS_PURGE_JOB_TIME_UTC | 02:00 | JANUS_USAGE_RETENTION_DAYS (default 365) and JANUS_AUDIT_RETENTION_DAYS (730) control purging, run daily at JANUS_PURGE_JOB_TIME_UTC (default 02:00). More |
JANUS_QUOTA_CHECKPOINT_INTERVAL_HOURS | 24 | JANUS_QUOTA_CHECKPOINT_INTERVAL_HOURS (default 24) bounds quota-counter recovery time. More |
JANUS_SMTP_FROM | janus@localhost | JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). More |
JANUS_SMTP_HOST | unset | JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). More |
JANUS_SMTP_PASSWORD | unset | JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). More |
JANUS_SMTP_PORT | 587 | JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). More |
JANUS_SMTP_USER | unset | JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). More |
JANUS_UPSTREAM_CONNECT_TIMEOUT_SECONDS | 10 | JANUS_UPSTREAM_CONNECT_TIMEOUT_SECONDS (default 10), JANUS_UPSTREAM_TTFB_TIMEOUT_SECONDS (30), and JANUS_UPSTREAM_TOTAL_TIMEOUT_SECONDS (600) set the default bound for each hop. More |
JANUS_UPSTREAM_TOTAL_TIMEOUT_SECONDS | 600 | JANUS_UPSTREAM_CONNECT_TIMEOUT_SECONDS (default 10), JANUS_UPSTREAM_TTFB_TIMEOUT_SECONDS (30), and JANUS_UPSTREAM_TOTAL_TIMEOUT_SECONDS (600) set the default bound for each hop. More |
JANUS_UPSTREAM_TTFB_TIMEOUT_SECONDS | 30 | JANUS_UPSTREAM_CONNECT_TIMEOUT_SECONDS (default 10), JANUS_UPSTREAM_TTFB_TIMEOUT_SECONDS (30), and JANUS_UPSTREAM_TOTAL_TIMEOUT_SECONDS (600) set the default bound for each hop. More |
JANUS_USAGE_RETENTION_DAYS | 365 | JANUS_USAGE_RETENTION_DAYS (default 365) and JANUS_AUDIT_RETENTION_DAYS (730) control purging, run daily at JANUS_PURGE_JOB_TIME_UTC (default 02:00). More |
Chat and files
| Variable | Default | Description |
|---|---|---|
JANUS_CHAT_AUTO_TITLE | true | JANUS_CHAT_AUTO_TITLE (default true) is the starting point for chat naming until an administrator chooses in Administration → Chat → Tools → Chat names. More |
JANUS_CHAT_MAX_UPLOAD_BYTES | 20 MiB | JANUS_CHAT_MAX_UPLOAD_BYTES (default 20 MiB) caps one chat attachment; the smaller of this and the storage cap applies. More |
JANUS_CHAT_PREVIEW | false | JANUS_CHAT_PREVIEW (default false) must be true for Janus Chat to be available at all; while it is false, Chat stays off whatever Administration → Chat says. More |
JANUS_CHAT_SEARCH_SEARXNG_URL | unset | JANUS_CHAT_SEARCH_SEARXNG_URL (unset) points at a SearXNG instance, such as http://searxng:8080, and turns Chat web search on with it once at startup; later admin changes stick. More |
JANUS_S3_ACCESS_KEY_ID | unset | Required with s3 storage. More |
JANUS_S3_BUCKET | unset | Required with s3 storage. More |
JANUS_S3_CA_FILE | unset | PEM file of extra CAs for the endpoint. Optional with s3 storage. More |
JANUS_S3_ENDPOINT | unset | Required with s3 storage. More |
JANUS_S3_PATH_STYLE | false | Optional with s3 storage. More |
JANUS_S3_PREFIX | unset | Key prefix. Optional with s3 storage. More |
JANUS_S3_REGION | us-east-1 | Optional with s3 storage. More |
JANUS_S3_SECRET_ACCESS_KEY | unset | Required with s3 storage. More |
JANUS_STORAGE_MAX_OBJECT_BYTES | 25 MiB | JANUS_STORAGE_MAX_OBJECT_BYTES (default 25 MiB) caps one stored file. More |
JANUS_STORAGE_MODE | unset | JANUS_STORAGE_MODE (database or s3; unset lets Administration → Settings → General → File storage decide) fixes where chat attachments and troubleshooting captures are stored. More |
Chat web pages
| Variable | Default | Description |
|---|---|---|
JANUS_WEB_ALLOW_DOMAINS | unset | JANUS_WEB_ALLOW_DOMAINS / JANUS_WEB_DENY_DOMAINS: only, or never, these sites (each matches its subdomains). More |
JANUS_WEB_ALLOW_NETWORKS | unset | JANUS_WEB_ALLOW_NETWORKS / JANUS_WEB_DENY_NETWORKS: only, or never, these IP ranges. More |
JANUS_WEB_ALLOW_PORTS | unset | JANUS_WEB_ALLOW_PORTS replaces 80, 443, 8080, 8443. More |
JANUS_WEB_ALLOW_PRIVATE | unset | JANUS_WEB_ALLOW_PRIVATE=true also opens private networks (10/8, 172.16/12, 192.168/16, 100.64/10, fc00::/7) and internal names (intranet, *.local, *.internal, *.lan, *.svc): for offline networks. More |
JANUS_WEB_DENY_DOMAINS | unset | JANUS_WEB_ALLOW_DOMAINS / JANUS_WEB_DENY_DOMAINS: only, or never, these sites (each matches its subdomains). More |
JANUS_WEB_DENY_NETWORKS | unset | JANUS_WEB_ALLOW_NETWORKS / JANUS_WEB_DENY_NETWORKS: only, or never, these IP ranges. More |
JANUS_WEB_HTTPS_ONLY | unset | JANUS_WEB_HTTPS_ONLY=true refuses http:// pages. More |
JANUS_WEB_PROXY | unset | JANUS_WEB_PROXY sends every page read through that proxy, with no direct fallback; the proxy then decides where names lead. More |
JANUS_WEB_TLS_TRUST | system | JANUS_WEB_TLS_TRUST: system (default), custom (system roots plus the trust store: DoD roots, JANUS_CA_BUNDLE, JANUS_CA_DIR and certificates uploaded under Settings → Certificates), or custom-only (only sites signed by the trust store’s CAs). More |
Licensing and updates
| Variable | Default | Description |
|---|---|---|
JANUS_LICENSE_FILE | unset | JANUS_LICENSE_FILE (unset) — path to a license key file; when present it takes precedence over a key installed from the UI. More |
JANUS_LICENSE_SYNC | unset | JANUS_LICENSE_SYNC (unset: the UI decides) pins automatic license renewal and sync on or off, and JANUS_LICENSE_SYNC_TOKEN pins its sync token. More |
JANUS_LICENSE_SYNC_TOKEN | unset | JANUS_LICENSE_SYNC (unset: the UI decides) pins automatic license renewal and sync on or off, and JANUS_LICENSE_SYNC_TOKEN pins its sync token. More |
JANUS_OFFLINE | false | JANUS_OFFLINE (default false) declares an air-gapped deployment: no update check, no license sync, and no personal subscriptions. More |
JANUS_UPDATE_CHECK | false | JANUS_UPDATE_CHECK (default false) turns on the daily check for a newer release. More |
Telemetry
| Variable | Default | Description |
|---|---|---|
JANUS_OTEL_EXPORTER_OTLP_ENDPOINT | unset | OTEL_EXPORTER_OTLP_ENDPOINT (or the alias JANUS_OTEL_EXPORTER_OTLP_ENDPOINT; unset means no OTLP export, /metrics only) sends metrics to an OpenTelemetry collector. More |
JANUS_OTEL_EXPORT_INTERVAL_SECONDS | 30 | How often, in seconds, metrics are sent to the OpenTelemetry collector. More |
OTEL_EXPORTER_OTLP_ENDPOINT | unset | OTEL_EXPORTER_OTLP_ENDPOINT (or the alias JANUS_OTEL_EXPORTER_OTLP_ENDPOINT; unset means no OTLP export, /metrics only) sends metrics to an OpenTelemetry collector. More |
STIG configuration profile
| Variable | Default | Description |
|---|---|---|
JANUS_OCSP_RESPONDER | unset | JANUS_OCSP_RESPONDER points every OCSP query at an enclave responder. More |
JANUS_STIG_PROFILE | false | JANUS_STIG_PROFILE=true puts Janus into its documented STIG configuration. More |
JANUS_TLS_REVOCATION | unset | Revocation checking of outbound TLS (JANUS_TLS_REVOCATION; hard in the STIG profile). Installed before any client connects. More |
Other
| Variable | Default | Description |
|---|---|---|
JANUS_BUILD_DATE | unset | JANUS_BUILD_VERSION (default dev), JANUS_BUILD_SHA (unknown) and JANUS_BUILD_DATE are build details set by the image; leave them alone. More |
JANUS_BUILD_SHA | unknown | JANUS_BUILD_VERSION (default dev), JANUS_BUILD_SHA (unknown) and JANUS_BUILD_DATE are build details set by the image; leave them alone. More |
JANUS_BUILD_VERSION | dev | JANUS_BUILD_VERSION (default dev), JANUS_BUILD_SHA (unknown) and JANUS_BUILD_DATE are build details set by the image; leave them alone. More |
JANUS_CONFIG_CACHE_TTL_SECONDS | 5 | JANUS_CONFIG_CACHE_TTL_SECONDS (default 5) is how long other replicas may serve model, grant, rule, quota rule, Security Gateway policy, Child Safety, router and rate-card settings — and classifier credentials and base URLs — before they see an admin change. More |
JANUS_GITHUB_OAUTH_CLIENT_ID | unset | JANUS_GITHUB_OAUTH_CLIENT_ID, JANUS_OPENAI_OAUTH_CLIENT_ID and JANUS_XAI_OAUTH_CLIENT_ID (unset: built-in IDs) replace the OAuth client IDs used to connect personal subscriptions. More |
JANUS_LOCAL_ONLY | false | JANUS_LOCAL_ONLY (default false) is for deployments with no billing: cost tracking is off, USD quotas stop applying and cannot be created, and all pricing is hidden in the UI and in Chat exports. More |
JANUS_OPENAI_OAUTH_CLIENT_ID | unset | JANUS_GITHUB_OAUTH_CLIENT_ID, JANUS_OPENAI_OAUTH_CLIENT_ID and JANUS_XAI_OAUTH_CLIENT_ID (unset: built-in IDs) replace the OAuth client IDs used to connect personal subscriptions. More |
JANUS_TROUBLESHOOT_DIR | unset | JANUS_TROUBLESHOOT_DIR (unset) lets troubleshooting sessions store captured bodies as files under that directory instead of in the database. More |
JANUS_XAI_OAUTH_CLIENT_ID | unset | JANUS_GITHUB_OAUTH_CLIENT_ID, JANUS_OPENAI_OAUTH_CLIENT_ID and JANUS_XAI_OAUTH_CLIENT_ID (unset: built-in IDs) replace the OAuth client IDs used to connect personal subscriptions. More |
No variable matches that filter.